In this video, you can follow along if you want to create a simple domain so we could have a small 1
environment, you could practice your red team effects on. For this environment, 2
we'll be setting up a Windows Server VM, which will be the domain controller for a domain in which 3
our Windows client will be joined to. 4
So the first thing we will want to do on a newly created Windows Server, which will be our domain controller, 5
is to set up our IP address statically. 6
This will ensure the IP never changes in case there is a DHCP server on the local network 7
that'll lease IP's randomly every so often, which would effectively change our domain controller IP, 8
which isn't good if your clients are trying to connect to the domain with the wrong IP for the domain 9
controller. 10
So take a quick glance at how I manually set up the IP address to 192.168.122.129. And we'll 11
close out. 12
And next, configure the Windows Server to a domain controller. 13
So just X out of everything until we get back to the server 14
manager. Which is a simple dashboard that has a lot of useful links for quick access to configuring the 15
Windows Server. 16
After clicking on configure this local server, click on the computer name as we'll change it to a domain 17
controller name that is more suitable. 18
I chose the name Fun DC 01, DC being short for domain controller and restart the computer to take on 19
the effect. 20
The reason I chose the name Fun DC 01 was because it's a simple way for me to have the domain, which 21
is Fun and to show that it's a domain controller. On the server manager click on add roles and features so 22
we can start the setup of the domain controller. 23
Click next and then ensure you have role based or feature based installations selected since we aren't 24
doing a VDI. 25
Click next on this page, select active directory domain services so we can easily add and manage users 26
on the domain later on. 27
And scrolling through, you can see a lot of other interesting roles that you could add for the server. 28
Next up, you can see a list of features that could be installed on the server. But for our simple setup 29
we can ignore this. 30
Now, let's install the active directory role we selected. 31
Click on promote this server to a domain controller, and next, select add a new forest giving the 32
root domain name fun.com 33
We use fun as our domain and I just use .com 34
But others may use .local or really whatever you want. 35
It doesn't really matter for our local domain set up that won't even be registered on the Internet. 36
Next, put in a DSRM or directory services restore mode password for offline emergency maintenance and 37
just click next on the specified delegation's option. For the next few options 38
just click next as well. 39
It looks like there's an issue and this issue will happen if the local administrator account on the 40
Windows system does not have a password. To fix this, we can add a password simply by first opening 41
up an administrator command prompt. 42
Run net user to see the local admins that are currently on the server. 43
And typically, the main local admin of concern is normally just named administrator. 44
So run the following net user command to add or change the password of the administrator account, and 45
now that the administrator account has a password, click previous and next to attempt the installation 46
again. 47
Be aware that all of these installation steps do take quite a bit of time, depending on the hardware 48
you may have. 49
So don't be alarmed if it takes quite a while. 50
Setting up a domain controller could normally be a day or more of a task for systems administrators 51
based on the hardware they're working with and the type of domain that they're required to set up. 52
And many restarts are also a very typical part of this process. 53
Once the server is restarted, log in to the local administrator account as we will be setting up some 54
user accounts through active directory. 55
Wait a little for the server desktop to load up and then search and open up active directory user and 56
computers as this will be where we can manage user accounts. 57
In here, you could get a list of information of our fun.com domain, for example, you could get 58
a list of computers connected to the domain and also a list of the domain controllers. 59
Click the users folder and you'll get a list of users and groups in the domain. To create a user, you 60
can right click and click 61
New and User. For our first user creation we'll create a user named John Doe. 62
And after filling in the first and last name, we can then fill in the user logon name, which I'll 63
just do in the format 64
First name 65
Dot 66
Last name. 67
Then we'll write in a password that's complex enough for the Windows domain. After writing the password, 68
uncheck user must change password at next log on so we don't have to change it 69
next time we log in. And also make sure password never expires is checked. 70
And now that we have the user created, let's right click on it and go to properties so we can change 71
the group the user is in. Click on the account tab and you'll see some account options and also the 72
option to unlock the account if it is ever locked. 73
And now to change the group the member is in, go to the Member Of tab. 74
And here you'll currently see that the user John Doe is in the Domain Users Group. 75
So next what we'll do is we'll create a domain admin that will be in the Domain Admins group. We'll right 76
click, click on new, and then user, I'll name the first domain admin Peter Pan with the same username 77
format of first dot 78
last name. Peter.Pan 79
I'm just naming it this way so I can easily distinguish the admins and users myself. 80
And again, we'll type in a password that's complex enough for the domain and then also make sure 81
user must change password 82
next log on is unchecked and then also password never expires. 83
And after creating the account, right click on it and go to properties, and once the properties 84
are open, go to the Member Of tab and you'll notice that the member is only in the domain users group. 85
So click on Add so we could add him to the domain admins group. Type in domain admins, click check names 86
so you could confirm that the group is there and then click OK, so we could add him to the Domain Admins 87
group. 88
All right. 89
Next, we'll create a domain user and a domain admin again, but this time just right click copy on 90
a user we already created. 91
And since I right click copied on Peter Pan, that means this user I create should be a domain admin. 92
So I filled in the name Jason Bourne and user logon name Jason.Bourne and again type in a complex password 93
because the domain group policy which you could easily change. 94
And then after creating the user account, we'll right click properties and then go to Member Of to 95
see what groups he's in, which is already domain admins and domain users. 96
Now, we'll create a normal domain user account by right 97
clicking on John Doe and then copy. 98
And then for this account, I'll just call it Jane Doe. 99
And then of course, the same first dot last name format for username. 100
And again, a complex password, which I've been using the same password for each account, just for 101
this red team environment. Then right click properties and go to the Member Of tab and noticed he is 102
only in the domain users group since we copied a user that was only in the domain users group. 103
So now that we have enough users for our red team domain, let's go over an example of how to add a 104
Windows client to the domain. 105
So while you're on your Windows client VM, which could either be Windows 7, Windows 10 or whatever 106
you want, the first thing we want to do is to set the IP address of the computer. 107
So I'm just doing this manually because I do not have a DHCP server in my local network. So set the 108
IP address to an IP address that's not currently being used. 109
The subnet mask needs to be the same subnet mask that was used for the domain controller. 110
And then we could set the preferred DNS server to the IP of the domain controller. 111
That way the client could resolve fun.com 112
And then now that we have an IP address on the same network as the domain controller, we could then 113
join the computer to the domain. 114
To join the Windows client to the domain, go to system properties and then click on change, which 115
will give you the option to join a domain. I set a new computer name for the client called Win10user 116
and just type in fun.com in the domain field and OK to bring up a prompt to join with credentials, 117
which in this case I'll be joining with a Peter.Pan domain admin we created earlier. 118
And then after successfully joining the domain, you'll have to restart the computer. 119
So then after the computer has successfully restarted, you'll want to click on Other User and then type 120
in the domain admin Peter.Pan's credentials to log into the domain fun. 121
And then since this is the first time that this account is logging in to the domain on this client, 122
it might take a little while longer than a normal log in to load up. 123
So then once it loads up, the first thing I'll do is open up a command prompt and type, whoamI just 124
to confirm that I am Peter.Pan. And then, of course, net user Peter.Pan /Domain, just to confirm I 125
am a domain admin. 126
And then because there's a beginner's course, you can follow along to disable the Windows firewall. 127
In Windows firewall settings, click Turn Windows Firewall On or Off, and then for domain network 128
settings, private network settings, and public network settings, we'll just click Turn off Windows Firewall. 129
Also, turn off Windows firewall on the Windows client as well. 130
And then next, we'll just disable the Windows defender so we don't have to be worried about spending 131
time obfuscating our payload to evade the antivirus.